What is AI regulation in Angola?
AI regulation: countries and regions
Angola has no dedicated artificial intelligence law in force. AI is governed indirectly through the Personal Data Protection Law (Law 22/11 of 17 June 2011) and its regulator, the Agencia de Proteccao de Dados (APD). A comprehensive AI bill drafted by the ministry MINTTICS entered public consultation in September 2025, and a revised data protection law that adds AI rules went to consultation in 2025. Both remain drafts as of mid-2026.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
Angola does not yet regulate artificial intelligence through a specific statute. The rules that bite on AI today are general ones: chiefly the Personal Data Protection Law, Law 22/11 of 17 June 2011, which governs how organisations collect and use personal data and gives individuals a right not to be subject to decisions taken solely by automated processing. That law is supervised by the Agencia de Proteccao de Dados (APD), the national data protection authority.
This is changing fast on paper. In 2025 the Ministry of Telecommunications, Information Technologies and Social Communication (MINTTICS) published a draft AI law, and the APD ran a public consultation on a wholesale revision of the data protection law that would add AI-specific provisions. Both are ambitious and detailed. Neither had been enacted as of mid-2026.
So the honest position is this: Angola is building a framework, but the binding rules for now are data protection, electronic communications and cybercrime laws, plus continental commitments such as the African Union Malabo Convention. Anyone deploying AI in Angola should plan against the existing law while watching the drafts closely.
Why it matters
For organisations, the gap between a fast-moving policy agenda and a thin enforced rulebook creates both freedom and risk. Today, an AI deployment in Angola is judged mainly against data protection duties: lawful basis, notification to or authorisation by the APD, limits on automated decision-making, and rules on international data transfers. Get those wrong and you are already exposed under Law 22/11, even with no AI-specific statute.
The drafts matter because they are unusually far-reaching. The AI bill asserts extraterritorial reach over systems that affect people in Angola, proposes a new competent authority for AI, a high-risk "Critical AI" tier, strict liability for developers and providers, mandatory insurance, and criminal penalties. If enacted in anything like its current form, it would reshape compliance for global vendors selling into or affecting Angola. Planning now, rather than after enactment, is the prudent course.
How it works
The law that actually applies: data protection
Angola's binding baseline for AI is its data protection regime. Law 22/11 of 17 June 2011 applies to automated and non-automated processing of personal data by controllers and processors established in Angola or using means located there. It sets principles of transparency, lawfulness, good faith, proportionality, accuracy and purpose limitation. It requires consent or another legal basis, and it requires prior notification to, or in some cases prior authorisation by, the APD. It restricts international transfers, requiring notification for transfers to countries with adequate protection and APD authorisation for transfers to countries without it. Crucially for AI, it gives data subjects the right not to be subject to decisions taken solely on the basis of automated processing that significantly affect them.
The regulator: the APD
The APD was created by Presidential Decree 214/16 of 10 October 2016, and its governing board was appointed by Presidential Decree 277/19 of 6 September 2019, chaired by Maria das Dores Jesus Correia Pinto. For years after the law passed, enforcement was minimal. The agency is now visibly more active: it runs awareness programmes, has issued guidance including a circular on personal data breach notification, and in 2025 signed a cooperation memorandum with Brazil's data protection authority, the ANPD, at the 47th Global Privacy Assembly in Seoul, South Korea, becoming the first Portuguese-speaking African authority to do so. It remains a young authority with limited enforcement history.
The draft AI law
MINTTICS prepared a draft Law on Artificial Intelligence, presented publicly in November 2025 after entering public consultation in September 2025. It runs to 86 articles across nine chapters. According to a Tech Hive Advisory review of the bill, its structure is "heavily influenced by contemporary international principles, particularly those of the Organisation for Economic Co-operation and Development (OECD) and the risk-based approach in the European Union's AI Act, which categorises AI systems based on their potential for harm." Notable features include: a new competent authority for AI and a coordination mechanism to set the national AI strategy; principles of transparency, fairness, security and accountability; a high-risk "Critical AI" category whose providers must register on a national AI oversight platform within seven working days of designation and conduct in-depth security risk assessments at least annually; obligations on developers and providers covering risk assessment, security, incident reporting, watermarking of AI-generated content and suitable insurance; a "reasonable use" exception for training data; and a human-in-the-loop requirement for public-sector and judicial uses. On penalties, the daily newspaper Expansao reported that the draft sets fines reaching up to 750 million kwanzas for individuals and 1.5 billion kwanzas for companies, alongside prison terms of one to twelve years for malicious use of AI systems. Tech Hive Advisory adds that grave-infraction administrative fines can reach up to 7,500 times the national minimum salary for individuals and 15,000 times for legal entities, with strict (objective) civil liability holding developers and providers jointly and severally liable.
The draft revised data protection law
In parallel, the APD put a full revision of Law 22/11 to public consultation, which ran from 17 March to 17 April 2025. The draft would replace the 2011 law and add a dedicated chapter on the processing of personal data by AI systems, including prohibited practices such as social scoring, duties on AI operators, and reinforced rights to contest automated decisions and demand human intervention. It also signals modern features such as a data protection officer requirement for some entities and stronger extraterritorial application.
The regional and continental layer
Angola sits inside several supranational frameworks. It ratified the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention) on 11 May 2020; the Convention entered into force across the continent on 8 June 2023. The AU Continental AI Strategy was endorsed by the AU Executive Council in July 2024, with a phased implementation running to 2030 that encourages member states to build national AI governance. As a member of the Southern African Development Community (SADC), Angola is also covered by the SADC Digital Transformation Strategy and a developing regional AI policy effort. Domestically, the White Paper on ICTs 2023 to 2027 and the long-term strategy Angola 2050 frame AI as a priority and envisage a national AI strategy.
Examples
A bank in Luanda deploying automated credit scoring. Under Law 22/11 it must have a lawful basis, notify or seek authorisation from the APD as required, and respect the data subject's right not to be subject to a decision taken solely by automated means. The draft revised data protection law would tighten this further by restricting fully automated credit and solvency decisions and reinforcing the right to human review.
A global software vendor selling an AI recruitment tool into Angola. Today the binding exposure is data protection: lawful processing, transfer rules and automated-decision limits. If the draft AI bill is enacted, its extraterritorial scope and "Critical AI" classification for systems affecting personal rights such as access to employment could bring the vendor within Angolan oversight, registration and insurance duties.
A public body using AI to triage citizen services. The existing constitutional and data protection rights apply now. The draft AI law would explicitly limit public-sector and judicial bodies to using AI as a "reference" only, mandating a human as the final decision-maker.
Common misunderstandings
"Angola has an AI law." It does not, as of mid-2026. There are two detailed drafts, but neither has been enacted or published in the official gazette.
"There is no regulation, so AI is unregulated." Incorrect. Personal data used in AI is regulated now under Law 22/11, supervised by the APD, and automated decision-making is already constrained.
"The data protection law is brand new." The substantive law in force dates from 2011. A revision went to public consultation in 2025 but remains a draft; the 2011 law still applies.
"The APD does not really do anything." Historically enforcement was thin, but the agency is now operational and increasingly active in guidance, awareness and international cooperation.
"Continental instruments override national law." The Malabo Convention and the AU Continental AI Strategy shape direction and create commitments, but day-to-day compliance is driven by Angolan national law.
Risks and boundaries
The central boundary is status. Angola has no AI-specific statute in force. The MINTTICS AI bill and the revised data protection law are drafts that completed or are in public consultation; they have not been approved by the Council of Ministers, passed by the National Assembly, or published in the Diario da Republica as of mid-2026. Their content, including the extraterritorial scope, the "Critical AI" tier, fines and criminal penalties, could change before enactment, or the instruments could stall.
This article is explanatory, not legal advice. Effective dates, thresholds and institutional powers should be verified against the official gazette and the APD before any compliance decision. Where this article describes draft provisions, treat them as proposals, not law. Enforcement capacity is also a genuine constraint: even where rules exist, the APD and any future AI authority face resource and expertise limits.
What to do next
Comply with what is binding now. Map your AI use against Law 22/11: lawful basis, APD notification or authorisation, automated-decision rights and international transfer rules. This is your immediate exposure.
Track the two drafts. Assign someone to monitor the MINTTICS AI bill and the APD's revised data protection law, and watch for Council of Ministers approval, National Assembly passage and gazette publication.
Prepare for the likely direction of travel. The drafts point to risk classification, transparency and labelling of AI content, human oversight of high-stakes decisions, incident reporting and possibly insurance. Building these into AI governance now reduces later cost.
Align with continental norms. Use the African Union Continental AI Strategy and the Malabo Convention as a stable reference for data governance and ethics, since national rules are being drawn from them.
Engage. Public consultations have been a real channel in Angola; participating shapes the rules you will live under.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Angola have a dedicated AI law?
No. As of mid-2026 there is no enacted AI statute. A draft AI law and a draft revised data protection law with AI provisions are in or after public consultation.
What law governs AI in Angola right now?
Mainly the Personal Data Protection Law, Law 22/11 of 17 June 2011, supervised by the APD, plus electronic communications and cybercrime laws.
Who is the regulator?
The Agencia de Proteccao de Dados (APD), the national data protection authority created in 2016 with its board appointed in 2019.
What does the draft AI law propose?
A risk-based framework with a new AI authority, a "Critical AI" high-risk tier, transparency, watermarking, strict liability, insurance duties and criminal penalties, with extraterritorial reach.
Has Angola signed the Malabo Convention?
Yes. Angola ratified the African Union Malabo Convention on 11 May 2020; it entered into force across the continent on 8 June 2023.
Does the African Union Continental AI Strategy apply to Angola?
It is not directly binding law, but as an AU member Angola is encouraged to develop national AI governance aligned with the strategy endorsed in July 2024.
Can I be subject to a fully automated decision in Angola?
Law 22/11 gives a right not to be subject to decisions taken solely by automated processing where they significantly affect you; the draft revision would strengthen this.
When will the AI law take effect?
That is unknown. Both drafts remain proposals; check the Diario da Republica and the APD for the current status.